Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/12/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe
Resource
win7-20240903-en
General
-
Target
e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe
-
Size
2.8MB
-
MD5
4151edefdf6c76d06b5d81845575876a
-
SHA1
93b891f61000a816830941eed9b7f1e7548e8815
-
SHA256
e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06
-
SHA512
1ce20434ff9ded386dd74d06a938699ef2f1d1c7ff310989893b63d7d64c3f73d21ac65e14408c8c3a84c5df132632f30d6787e65f200e4bf327e3cb0d3479f3
-
SSDEEP
49152:6jHqiQyBFWr7HkXfuMWfxEN2dLJ276vqu14t6:6jKYB4r7EXfuZLdlc6vXI
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
default_valenciga
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://shineugler.biz/api
Extracted
lumma
https://shineugler.biz/api
Signatures
-
Amadey family
-
Lumma family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ v_dolg.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 19 2532 rundll32.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion v_dolg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion v_dolg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe -
Executes dropped EXE 14 IoCs
pid Process 2836 axplong.exe 1644 stealc_default2.exe 2804 alexshlu.exe 1700 AllNew.exe 2180 Gxtuum.exe 1312 am209.exe 1740 defnur.exe 2432 v_dolg.exe 2472 roblox.exe 1556 stub.exe 2884 goldlummaa.exe 1328 sintv.exe 1016 Out.exe 2668 Out.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine axplong.exe -
Loads dropped DLL 26 IoCs
pid Process 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 2836 axplong.exe 2836 axplong.exe 2836 axplong.exe 2836 axplong.exe 2836 axplong.exe 1700 AllNew.exe 2836 axplong.exe 1312 am209.exe 2836 axplong.exe 1644 stealc_default2.exe 1644 stealc_default2.exe 2836 axplong.exe 2472 roblox.exe 1556 stub.exe 2836 axplong.exe 2836 axplong.exe 2836 axplong.exe 2532 rundll32.exe 2532 rundll32.exe 2532 rundll32.exe 2532 rundll32.exe 2836 axplong.exe 2836 axplong.exe 1016 Out.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA v_dolg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 2836 axplong.exe 2432 v_dolg.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome.exe sintv.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe sintv.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe File created C:\Windows\Tasks\Gxtuum.job AllNew.exe File created C:\Windows\Tasks\defnur.job am209.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language am209.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language v_dolg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AllNew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language defnur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Out.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Out.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\Root\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D Out.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\Root\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D\Blob = 0f0000000100000020000000a98388d3305904fcbba6ba4aa1f48700a62dd93a0095f52ca620649c35f86ca503000000010000001400000044cbf10ada24fe3121d5aa13b1ba7b5ef4afd89d0200000001000000cc0000001c0000006c000000010000000000000000000000000000000100000043004e003d0054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea00302010202082b3c1df5a4302b73300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233313231373032343435375a170d3237303332323032343435375a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100874be3d30c3438413a51c081090b27923a4eb5566bed6da2a5de0e5afb441bfe8c99cf76663327b6ee4031c750f94e84633bd88e8029225083d0fa8c6788f4f5fca44f8b831ff26480ad7cd37f72c4bc5734274b9f9e33869a0e7e3beadd6ffbab130002674e1af5c5a861cba7751faeb50e77613aa5a6f1facc990aea771b4989c3aaa4f89bed0d9d92348212b84b28503da131662fa12e8849e70d4555dacadfe2eb1cb572464933b86fd5e4baf1ac32bb3acbd8352902049172dda8e8af90111fd7514917236b5ff649fb540e5be1c329e4906ea642f6853519dbe0f6c44a1b434a7a6d265d097ce9605d2c2a426523be039ba8dfa54409b91e3078ebfe7b0203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101002d40a7ed6188ff879719a5b46c610b3f79b4a450b0adcceff1a1108dfb44c9b604576626d691b340015c394e7f2f2c522cc90bc26ecac4cff44b1539127dffee16fbcd105dc2ca78d487516c93ebe8016fe02323fc51656da038d4a13f7f0a441ba49c310d1e0740865292df0bfc270289125f630ff7d2108007df607873f045bdaeeec18e44b3c52a983bb1946483bb1ac95a395fc12f602261106c13fae39333f3298b6ac84a7d849f3e412b8b2e44cd5fc22e99042ca18d37996f5f6e3f53ea8c27b4c81e3ea4d1794216c879594fa48a2b2fb6694c1909e6cc14530f58c11497dee2e5e293a60f984c6dd81e09723cd48a965c937a4f3ce81f2d8a33f42d Out.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Out.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Out.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\Root\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D\Blob = 14000000010000001400000076f65cd3b3b5a5d7ec205a7c2b15a8768a99a53e0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c000000010000000000000000000000000000000100000043004e003d0054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e0030000000000003000000010000001400000044cbf10ada24fe3121d5aa13b1ba7b5ef4afd89d0f0000000100000020000000a98388d3305904fcbba6ba4aa1f48700a62dd93a0095f52ca620649c35f86ca520000000010000000a03000030820306308201eea00302010202082b3c1df5a4302b73300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233313231373032343435375a170d3237303332323032343435375a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100874be3d30c3438413a51c081090b27923a4eb5566bed6da2a5de0e5afb441bfe8c99cf76663327b6ee4031c750f94e84633bd88e8029225083d0fa8c6788f4f5fca44f8b831ff26480ad7cd37f72c4bc5734274b9f9e33869a0e7e3beadd6ffbab130002674e1af5c5a861cba7751faeb50e77613aa5a6f1facc990aea771b4989c3aaa4f89bed0d9d92348212b84b28503da131662fa12e8849e70d4555dacadfe2eb1cb572464933b86fd5e4baf1ac32bb3acbd8352902049172dda8e8af90111fd7514917236b5ff649fb540e5be1c329e4906ea642f6853519dbe0f6c44a1b434a7a6d265d097ce9605d2c2a426523be039ba8dfa54409b91e3078ebfe7b0203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101002d40a7ed6188ff879719a5b46c610b3f79b4a450b0adcceff1a1108dfb44c9b604576626d691b340015c394e7f2f2c522cc90bc26ecac4cff44b1539127dffee16fbcd105dc2ca78d487516c93ebe8016fe02323fc51656da038d4a13f7f0a441ba49c310d1e0740865292df0bfc270289125f630ff7d2108007df607873f045bdaeeec18e44b3c52a983bb1946483bb1ac95a395fc12f602261106c13fae39333f3298b6ac84a7d849f3e412b8b2e44cd5fc22e99042ca18d37996f5f6e3f53ea8c27b4c81e3ea4d1794216c879594fa48a2b2fb6694c1909e6cc14530f58c11497dee2e5e293a60f984c6dd81e09723cd48a965c937a4f3ce81f2d8a33f42d Out.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\Root\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D\Blob = 1900000001000000100000009140e01f2a6f3e39f3b53dc88237f5350f0000000100000020000000a98388d3305904fcbba6ba4aa1f48700a62dd93a0095f52ca620649c35f86ca503000000010000001400000044cbf10ada24fe3121d5aa13b1ba7b5ef4afd89d0200000001000000cc0000001c0000006c000000010000000000000000000000000000000100000043004e003d0054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000014000000010000001400000076f65cd3b3b5a5d7ec205a7c2b15a8768a99a53e20000000010000000a03000030820306308201eea00302010202082b3c1df5a4302b73300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233313231373032343435375a170d3237303332323032343435375a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100874be3d30c3438413a51c081090b27923a4eb5566bed6da2a5de0e5afb441bfe8c99cf76663327b6ee4031c750f94e84633bd88e8029225083d0fa8c6788f4f5fca44f8b831ff26480ad7cd37f72c4bc5734274b9f9e33869a0e7e3beadd6ffbab130002674e1af5c5a861cba7751faeb50e77613aa5a6f1facc990aea771b4989c3aaa4f89bed0d9d92348212b84b28503da131662fa12e8849e70d4555dacadfe2eb1cb572464933b86fd5e4baf1ac32bb3acbd8352902049172dda8e8af90111fd7514917236b5ff649fb540e5be1c329e4906ea642f6853519dbe0f6c44a1b434a7a6d265d097ce9605d2c2a426523be039ba8dfa54409b91e3078ebfe7b0203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101002d40a7ed6188ff879719a5b46c610b3f79b4a450b0adcceff1a1108dfb44c9b604576626d691b340015c394e7f2f2c522cc90bc26ecac4cff44b1539127dffee16fbcd105dc2ca78d487516c93ebe8016fe02323fc51656da038d4a13f7f0a441ba49c310d1e0740865292df0bfc270289125f630ff7d2108007df607873f045bdaeeec18e44b3c52a983bb1946483bb1ac95a395fc12f602261106c13fae39333f3298b6ac84a7d849f3e412b8b2e44cd5fc22e99042ca18d37996f5f6e3f53ea8c27b4c81e3ea4d1794216c879594fa48a2b2fb6694c1909e6cc14530f58c11497dee2e5e293a60f984c6dd81e09723cd48a965c937a4f3ce81f2d8a33f42d Out.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Out.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 2836 axplong.exe 1644 stealc_default2.exe 2432 v_dolg.exe 1644 stealc_default2.exe 1328 sintv.exe 2668 Out.exe 2668 Out.exe 2668 Out.exe 2668 Out.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1328 sintv.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 1700 AllNew.exe 1312 am209.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2836 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 31 PID 1224 wrote to memory of 2836 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 31 PID 1224 wrote to memory of 2836 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 31 PID 1224 wrote to memory of 2836 1224 e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe 31 PID 2836 wrote to memory of 1644 2836 axplong.exe 33 PID 2836 wrote to memory of 1644 2836 axplong.exe 33 PID 2836 wrote to memory of 1644 2836 axplong.exe 33 PID 2836 wrote to memory of 1644 2836 axplong.exe 33 PID 2836 wrote to memory of 2804 2836 axplong.exe 34 PID 2836 wrote to memory of 2804 2836 axplong.exe 34 PID 2836 wrote to memory of 2804 2836 axplong.exe 34 PID 2836 wrote to memory of 2804 2836 axplong.exe 34 PID 2836 wrote to memory of 1700 2836 axplong.exe 36 PID 2836 wrote to memory of 1700 2836 axplong.exe 36 PID 2836 wrote to memory of 1700 2836 axplong.exe 36 PID 2836 wrote to memory of 1700 2836 axplong.exe 36 PID 1700 wrote to memory of 2180 1700 AllNew.exe 37 PID 1700 wrote to memory of 2180 1700 AllNew.exe 37 PID 1700 wrote to memory of 2180 1700 AllNew.exe 37 PID 1700 wrote to memory of 2180 1700 AllNew.exe 37 PID 2836 wrote to memory of 1312 2836 axplong.exe 38 PID 2836 wrote to memory of 1312 2836 axplong.exe 38 PID 2836 wrote to memory of 1312 2836 axplong.exe 38 PID 2836 wrote to memory of 1312 2836 axplong.exe 38 PID 1312 wrote to memory of 1740 1312 am209.exe 39 PID 1312 wrote to memory of 1740 1312 am209.exe 39 PID 1312 wrote to memory of 1740 1312 am209.exe 39 PID 1312 wrote to memory of 1740 1312 am209.exe 39 PID 2836 wrote to memory of 2432 2836 axplong.exe 40 PID 2836 wrote to memory of 2432 2836 axplong.exe 40 PID 2836 wrote to memory of 2432 2836 axplong.exe 40 PID 2836 wrote to memory of 2432 2836 axplong.exe 40 PID 2836 wrote to memory of 2472 2836 axplong.exe 41 PID 2836 wrote to memory of 2472 2836 axplong.exe 41 PID 2836 wrote to memory of 2472 2836 axplong.exe 41 PID 2836 wrote to memory of 2472 2836 axplong.exe 41 PID 2472 wrote to memory of 1556 2472 roblox.exe 43 PID 2472 wrote to memory of 1556 2472 roblox.exe 43 PID 2472 wrote to memory of 1556 2472 roblox.exe 43 PID 2836 wrote to memory of 2884 2836 axplong.exe 44 PID 2836 wrote to memory of 2884 2836 axplong.exe 44 PID 2836 wrote to memory of 2884 2836 axplong.exe 44 PID 2836 wrote to memory of 2884 2836 axplong.exe 44 PID 2836 wrote to memory of 1328 2836 axplong.exe 46 PID 2836 wrote to memory of 1328 2836 axplong.exe 46 PID 2836 wrote to memory of 1328 2836 axplong.exe 46 PID 2836 wrote to memory of 1328 2836 axplong.exe 46 PID 1740 wrote to memory of 2532 1740 defnur.exe 47 PID 1740 wrote to memory of 2532 1740 defnur.exe 47 PID 1740 wrote to memory of 2532 1740 defnur.exe 47 PID 1740 wrote to memory of 2532 1740 defnur.exe 47 PID 1740 wrote to memory of 2532 1740 defnur.exe 47 PID 1740 wrote to memory of 2532 1740 defnur.exe 47 PID 1740 wrote to memory of 2532 1740 defnur.exe 47 PID 1328 wrote to memory of 2232 1328 sintv.exe 50 PID 1328 wrote to memory of 2232 1328 sintv.exe 50 PID 1328 wrote to memory of 2232 1328 sintv.exe 50 PID 2836 wrote to memory of 1016 2836 axplong.exe 52 PID 2836 wrote to memory of 1016 2836 axplong.exe 52 PID 2836 wrote to memory of 1016 2836 axplong.exe 52 PID 2836 wrote to memory of 1016 2836 axplong.exe 52 PID 1016 wrote to memory of 2668 1016 Out.exe 53 PID 1016 wrote to memory of 2668 1016 Out.exe 53 PID 1016 wrote to memory of 2668 1016 Out.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe"C:\Users\Admin\AppData\Local\Temp\e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"3⤵
- Executes dropped EXE
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2532
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\onefile_2472_133788770909320000\stub.exeC:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556
-
-
-
C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe"C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe"3⤵
- Executes dropped EXE
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe"C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\System32\certutil.exe"C:\Windows\System32\certutil.exe" -silent -importPFX -p "" -f "C:\Users\Admin\AppData\Local\Temp\tmp4942.tmp"4⤵PID:2232
-
-
-
C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307KB
MD568a99cf42959dc6406af26e91d39f523
SHA1f11db933a83400136dc992820f485e0b73f1b933
SHA256c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3
SHA5127342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75
-
Filesize
809KB
MD59821fa45714f3b4538cc017320f6f7e5
SHA15bf0752889cefd64dab0317067d5e593ba32e507
SHA256fd9343a395c034e519aea60471c518edbd8cf1b8a236ec924acf06348e6d3a72
SHA51290afec395115d932ea272b11daa3245769bdcc9421ecd418722830259a64df19ed7eacca38000f6a846db9f4363817f13232032ab30f2ab1aa7e88097361d898
-
Filesize
429KB
MD5c07e06e76de584bcddd59073a4161dbb
SHA108954ac6f6cf51fd5d9d034060a9ae25a8448971
SHA256cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9
SHA512e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f
-
Filesize
429KB
MD5ce27255f0ef33ce6304e54d171e6547c
SHA1e594c6743d869c852bf7a09e7fe8103b25949b6e
SHA25682c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c
SHA51296cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9
-
Filesize
3.6MB
MD5378706614b22957208e09fc84fceece8
SHA1d35e1f89f36aed26553b665f791cd69d82136fb8
SHA256df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d
SHA512bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e
-
Filesize
10.7MB
MD56898eace70e2da82f257bc78cb081b2f
SHA15ac5ed21436d8b4c59c0b62836d531844c571d6d
SHA256bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23
SHA512ca719707417a095fe092837e870aefc7e8874ef351e27b5b41e40f46a9e2f6cb2ba915858bc3c99a14c2f1288c71c7ddd9c2adee6588d6b43cd3ba276e1585d2
-
Filesize
396KB
MD5876bf2dec67ea8626322d2c268219d76
SHA1ecb0c0cd486733491804a05cf387f2d04d5e2279
SHA25608d37bbc1881f5fbfdcc84e3270320bb4d03a3ad4fcdf1d996c9de0ca8f2b425
SHA5129268392683a9962143f987f069d97016abd1ccd61bb67aa8e3f8d9c4b7aa6168d3c01884ce9023831216b8710eddee2d52fcb3c84dbacefe94cb28fa661b6a79
-
Filesize
4.5MB
MD538fcaa23700e62fb0b3fc2591f82cc80
SHA1abedd6ec573a6fede05d15920f3ac3763062c75c
SHA256fb829a6a8535a443932cd167e8301b5e74c60702b5f7fade7e9f13a736ce72b0
SHA5125da88a61c716a9891cb225f36f275040d69915c4c731c2a5c042d5c997ca39241a3e9d6646569468d477f47db42462c21b58f2de7f56a84cb145e6cee478eeef
-
Filesize
2.5MB
MD57ff947867bc70055adffa2164a741b01
SHA1cff424168c2f6bcef107ebc9bd65590f3ead76ae
SHA256b6d6628d2dc7dea808eef05180c27abe10a1af245d624aacdacccc52a1eb7b40
SHA512da507d1847056d0dc2c122c45ecbea4901a81c06890bcdbffc2f18ad4b96f0ac2c2fa9ebde1a315828c74a97af653062a8c50ce70c9b6d6966c48871150747ee
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2KB
MD528fc139ec2d53ccea82aba253f5f405e
SHA171069ccc7e53fb8b2cbcbbd478a78821010bb6ef
SHA256148987f7e201defbe41fa7de3ec8909f9400afdc1b38dac405aa1917cefff8cd
SHA512ae4c7db5970ae265049e302b0c880f2f92e8dafc0e671b1e863aadcbbdbd5bec5658c002abaab35b5a2955effe9427ad2305857188ee6a4012feb83df2acfb57
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
16.1MB
MD5d09a400f60c7a298e884f90539e9c72f
SHA141582ba130bef907e24f87534e7a0fdd37025101
SHA256700962aa295e2fa207ff522e2f5ca051a2929eb6f252d42c9cb0a56a4f084bfe
SHA512d8ba2859bb2ea109c1ca33cb924e40bf61db79aefb59324101d9f47a08835d86834790d3bc6bad4151a561ef82265b32d5111bc80f95dce769c5eb4da5116cc9
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D
Filesize1KB
MD5ae54a540d7a5e4eed26caa8e5ce6b01e
SHA15369e13d9638d6b1332cd584494496b9338ff09d
SHA2564f1ee7e382702da70ea3debb4a8836932b17d1094e193795e788b0e2f6394a22
SHA512c259fd7d3ec7ddbbaf6da99c16e9498c0e3883d5347dd5c9cb9dc2beec9cc94146d494a58169f96e0b0b2d881236eedb0c9a6a3d5cbd3625a26dfc423b8006f6
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D
Filesize1KB
MD51ed31ac29ea8c31d081132fa2a32b2ad
SHA1423e7571672c914a885fec7fe4eecdade3c87fb0
SHA2567dc7aacb2b961182a57b4aaa792b1ede09e04f32e33252ab070bdb67d198c5ed
SHA512b4b0c45f7df949675f7e24588adb3400cdb0c82526db830e114d56feb704cb3ba306110a31752635bd44ddf0fbb51bcaa935f169c0fbe5ca3dbcb0c7577285a6
-
Filesize
124KB
MD50d3418372c854ee228b78e16ea7059be
SHA1c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1
SHA256885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7
SHA512e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
2.8MB
MD54151edefdf6c76d06b5d81845575876a
SHA193b891f61000a816830941eed9b7f1e7548e8815
SHA256e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06
SHA5121ce20434ff9ded386dd74d06a938699ef2f1d1c7ff310989893b63d7d64c3f73d21ac65e14408c8c3a84c5df132632f30d6787e65f200e4bf327e3cb0d3479f3